Nexcore//Alliance
Red Team

SUBDOMAIN SCANNER

Perform broad reconnaissance across target domains to discover active subdomains and audit host security configurations.

Target Reconnaissance

Ownership Verification

Verify asset ownership before scanning

We require a same-organization work email plus a DNS TXT or HTTP file proof on your target domain.

1. Start2. Email3. Proof4. Scan

Use a company-managed email that matches the target domain or one of its approved subdomains.

What this checks

  • Email-domain match
  • Domain control proof
  • WHOIS / RDAP / DNS context

DNS and CDN changes can take time to propagate. If your proof is newly published, wait a few minutes and run the proof check again instead of starting a brand-new scan.

Scanner Scope

  • Resolves subdomains mapping matrices to locate unknown attack vectors.
  • Audits active ports, DNS values, and host headers records configurations.
  • Logs telemetry data to optimize penetration testing security posture.